4.100.2: the page prefetch runs under a nonce policy (the navbar's rules carry the page's nonce) (#262)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 63c6097..3498bf0 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,14 @@ All notable changes to `openvibe-shared`. Versions follow [semver](https://semve
  breaking change to any exported module, browser global or served file name is a new major.
  A release is the git tag `vX.Y.Z`; consumers pin the tag's tarball (see README).
  
++## 4.100.2 — 2026-11-02
++
++- **The page prefetch runs under a nonce policy.** The navbar's inline speculation rules (4.70.0) were refused on
++  every page whose Content-Security-Policy names a nonce: openvibe.chat logged it on each page. Chrome 156 ignores
++  `'inline-speculation-rules'` beside a nonce. The navbar now gives its rules the page's own nonce, read from any of
++  its nonced scripts. Checked on production's openvibe.chat/vibe with this navbar.js swapped in: no violation, and
++  the rules carry the nonce.
++
  ## 4.100.1 — 2026-11-02
  
  - **The browser harness counts a counted fold's text as on the page.** A closed `<details>` opens with one tap, with
ddiff --git a/README.md b/README.md
iindex aa45332..88249aa 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Versioned UI, the OpenVibe Frame (the navbar, footer and "shipped" views every site sits in), SEO, legal and release-client packages every OpenVibe site renders.
  
--**Status:** alpha, v4.100.1 (every release is a tag; see [CHANGELOG.md](CHANGELOG.md)). Every deployed
++**Status:** alpha, v4.100.2 (every release is a tag; see [CHANGELOG.md](CHANGELOG.md)). Every deployed
  consumer installs a tagged release and none keeps a vendored copy
  ([docs/migration-plan.md](docs/migration-plan.md) is done); each repository's `package.json` names
  the tag it pins.
ddiff --git a/STATUS.json b/STATUS.json
iindex f943722..ab32b95 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -4,7 +4,7 @@
    "code": true,
    "wave": "W2",
    "package": "openvibe-shared",
--  "version": "4.100.1",
++  "version": "4.100.2",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026)",
    "deployed": false,
    "deployment": "none of its own: a package released as git tags; OpenVibe.Network serves /shared/* from its pinned tag, and a site can serve its own pinned copy (openvibe-shared/serve)",
ddiff --git a/navbar.js b/navbar.js
iindex f34e814..53f3ca6 100644
---- a/navbar.js
++++ b/navbar.js
@@@ -2110,6 +2110,11 @@
              try {
                  const sr = document.createElement('script');
                  sr.type = 'speculationrules';
++                // A page whose policy names a nonce (Chat, Search…) runs inline speculation rules only with it: Chrome 156
++                // ignores 'inline-speculation-rules' beside a nonce (2026-11-02). The page's own nonce is read from any of
++                // its nonced scripts (the attribute is blanked once parsed; the property keeps it).
++                const nonce = [].slice.call(document.scripts || []).map((x) => x.nonce).find(Boolean);
++                if (nonce) sr.nonce = nonce;
                  sr.textContent = JSON.stringify({ prefetch: [{ where: { and: [{ href_matches: '/*' }, { not: { href_matches: ['/auth/*', '/api/*', '/logout*', '/*logout*', '/signout*', '/internal/*', '/*.zip', '/*.pdf'] } }, { not: { selector_matches: '[data-no-prefetch], [download], [rel~=nofollow]' } }] }, eagerness: 'moderate' }] });
                  document.head.appendChild(sr);
              } catch { /* an old browser: links load as they always did */ }
ddiff --git a/package.json b/package.json
iindex 9f033dc..db1e99b 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-shared",
--  "version": "4.100.1",
++  "version": "4.100.2",
    "description": "Shared navbar, footer, themes, icons, legal pages, SEO, auth and analytics for every OpenVibe site",
    "main": "index.js",
    "bin": {